| """ |
| interview/permissions.py — Custom DRF permissions for the admin dashboard. |
| """ |
|
|
| from rest_framework.permissions import BasePermission |
|
|
|
|
| class IsAdminRole(BasePermission): |
| """ |
| Allows access only to authenticated users with role='admin' or superusers. |
| Used on all Dashboard-only endpoints to prevent regular students from |
| accessing admin data even if they have a valid JWT. |
| """ |
| message = 'Acceso denegado. Se requiere rol de administrador.' |
|
|
| def has_permission(self, request, view): |
| if not request.user or not request.user.is_authenticated: |
| return False |
| return request.user.is_superuser or getattr(request.user, 'role', '') == 'admin' |
|
|
